PHP Upgrade on Linux Server: Impact, Fixes and Best Practices

Home › Blog › PHP Upgrade on Linux Server: Impact, Fixes and Best Practices

By the DESSS Team | Updated November 2026

Most of the world's PHP runs on Linux, usually Nginx or Apache with PHP-FPM. That also makes Linux servers the main target for the PHP2Shell attacks disclosed in October 2026. The upgrade itself is usually easier than on Windows, but it has its own traps, and one of them can leave you thinking you're safe when you aren't.

This guide walks through what's changed, the issues we run into most on Ubuntu, Debian, RHEL and AlmaLinux servers, and a step-by-step upgrade path. For the full timeline, see PHP Upgrade 2026: What Just Happened.

What Linux admins need to know right now

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an attacker run commands on your server with a single crafted request. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• CVE-2026-115560 is a separate session upload progress bug that the October fixes don't cover.
• PHP 8.2 reaches end of life on December 31, 2026. PHP 8.1 and older are already unsupported upstream.
• PHP 8.6 ships November 19, 2026, with stricter session cookie defaults.

Common problems on Linux

Your distribution may be behind

Each distribution ships its own PHP version and patches it on its own schedule.

Distribution vendors sometimes backport security fixes into their own older PHP packages, so "8.1" from Ubuntu isn't always the same as unpatched 8.1. Check your vendor's security notice for PHP2Shell before deciding. If you need a newer PHP than your distribution offers, the widely used options are Ondřej Surý's repository for Ubuntu and Debian, and Remi's repository for RHEL, AlmaLinux and Rocky Linux.

Your site and your terminal may use different PHP versions

It's common to have several PHP versions installed side by side. The command line, cron jobs and the web server can each use a different one. Always check what the website itself runs, using a temporary phpinfo() page on staging, not just php -v. On Debian and Ubuntu, update-alternatives --config php sets the CLI version.

Extensions must be reinstalled per version

Each PHP version has its own extension packages, such as php8.4-mysql, php8.4-gd, php8.4-intl, php8.4-curl and php8.4-mbstring.

Config files don't follow you

On Debian and Ubuntu, each version has its own folder (/etc/php/8.4/fpm/php.ini and pool.d/). Your memory limits, upload sizes and pool settings need to be copied over and reviewed. Remember that PHP 8.5 always builds in OPcache, so remove old zend_extension=opcache.so lines.

Hosting panels and containers

• cPanel/WHM: use EasyApache 4 and MultiPHP Manager to install patched versions and switch each account.
• Plesk: update PHP through the Plesk updater, then confirm each domain's PHP handler.
• Docker: rebuild images from a patched base tag (for example php:8.4-fpm) with --pull, rather than reusing cached layers. A rebuild without a pull can keep the old PHP.

SELinux and permissions

On RHEL-family systems, new PHP paths or sockets may need the correct SELinux context.

Best practices for PHP on Linux

• Patch fast, upgrade carefully. Security patches within your branch should go out within days. Version upgrades go through staging first.
• Always restart PHP-FPM after updates, and confirm with the actual site.
• Use separate FPM pools per site, with their own users, so one compromised site can't read another.
• Set pm.max_requests so workers recycle regularly.
• Watch for odd child processes. PHP2Shell activity often shows up as php-fpm spawning sh, bash, curl or wget.
• Automate checks. Add PHP version checks to your monitoring or configuration management (Ansible, Puppet) so drift is caught early.

How DESSS helps with Linux PHP upgrades

We manage Linux web servers on bare metal, VPS, AWS, Azure and other cloud platforms. Our team can:

• Patch your servers and containers against PHP2Shell and verify the running code
• Upgrade PHP across Ubuntu, Debian, RHEL, AlmaLinux, cPanel and Plesk
• Rebuild Docker images and CI pipelines on supported PHP versions
• Fix application code for deprecated features through our Application Maintenance team
• Harden servers with help from our Cybersecurity specialists
• Keep everything current through Managed IT Services

Request a customized quote

Share your Linux distribution, web server, PHP version, hosting panel (if any) and how many servers or containers you run. We'll put together a clear plan and quote.

Request your customized Linux PHP upgrade quote

Disclaimer

The information in this article is provided for general informational and educational purposes only. It reflects publicly available information as of November 4, 2026. PHP versions, support dates, security advisories and third-party software change often, so always confirm details with official sources such as php.net and your software vendors before making changes.

This article is not professional, legal or security advice, and following these steps does not guarantee protection against every vulnerability or compatibility issue. Always back up your systems and test upgrades in a staging environment before applying them to production. DESSS, Inc. is not liable for any loss, damage or downtime resulting from the use of this information.

Product names and trademarks mentioned (including PHP, Microsoft, Windows, IIS, SQL Server, Oracle, MySQL, MariaDB, PostgreSQL, Ubuntu, Debian, Red Hat, cPanel and Plesk) belong to their respective owners and are used for identification only. Links to third-party sources do not imply endorsement. Please also see the DESSS Disclaimer and Privacy Policy.